SUSPICIOUS
42
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
The PDF document was flagged for using a password protection lure, a common tactic to make users believe the content is sensitive and requires a password, often to bypass security scanning or to facilitate social engineering. While a URL was extracted, it was confirmed as benign. No scripts were extracted from this sample. The primary indicator is the password archive lure, suggesting a social engineering attempt.
Machine Learning
- Nyx PDF Classifier clean score 0.0002
Heuristics 2
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://youtu.be/bnM-WhO-ZPk?si=PuuENjf9hFVF568A In PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.